System for monitoring and delivering medication to a patient and method of using the same to minimize the risks associated with automated therapy

ABSTRACT

A system and method for monitoring and delivering medication to a patient. The system includes a controller that has a control algorithm and a closed loop control that monitors the control algorithm. A sensor is in communication with the controller and monitors a medical condition. A rule based application in the controller receives data from the sensor and the closed loop control and compares the data to predetermined medical information to determine the risk of automation of therapy to the patient. A system monitor is also in communication with the controller to monitor system, remote system, and network activity and conditions. The controller then provides a predetermined risk threshold where below the predetermined risk threshold automated closed loop medication therapy is provided. If the predetermined risk threshold is met or exceeded, automated therapy adjustments may not occur and user/clinician intervention is requested.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application is a continuation of U.S. patent application Ser. No.14/739,840, entitled “System for Monitoring and Delivering Medication toa Patient and Method of Using the Same to Minimize the Risks Associatedwith Automated Therapy,” filed Jun. 15, 2015, which claims the benefitof priority to U.S. Provisional Patent Application No. 62/012,756,entitled “System for Monitoring and Delivering Medication to a Patientand Method of Using the Same to Minimize the Risks Associated withAutomated Therapy,” filed Jun. 16, 2014, the disclosures of which arehereby incorporated by reference in their entirety.

BACKGROUND OF THE INVENTION

This invention relates to a system for monitoring and deliveringmedication to a patient. More specifically, the present invention isdirected toward a device that monitors the risk to a patient of anautomated therapy decision and allows a clinician to customize rulesthat determine whether an automated change in therapy is to be allowedor whether user/clinician intervention should be required based upon therisk of automation and the customized rules.

Diabetes is a metabolic disorder that afflicts tens of millions ofpeople throughout the world. Diabetes results from the inability of thebody to properly utilize and metabolize carbohydrates, particularlyglucose. Normally, the finely tuned balance between glucose in the bloodand glucose in bodily tissue cells is maintained by insulin, a hormoneproduced by the pancreas which controls, among other things, thetransfer of glucose from blood into body tissue cells. Upsetting thisbalance causes many complications and pathologies including heartdisease, coronary and peripheral artery sclerosis, peripheralneuropathies, retinal damage, cataracts, hypertension, coma, and deathfrom hypoglycemic shock.

In patients with insulin-dependent diabetes the symptoms of the diseasecan be controlled by administering additional insulin (or other agentsthat have similar effects) by injection or by external or implantableinsulin pumps. The correct insulin dosage is a function of the level ofglucose in the blood. Ideally, insulin administration should becontinuously readjusted in response to changes in blood glucose level.In diabetes management, insulin enables the uptake of glucose by thebody's cells from the blood. Glucagon acts opposite to insulin andcauses the liver to release glucose into the blood stream. The basalrate is the rate of continuous supply of insulin provided by an insulindelivery device (pump). The bolus is the specific amount of insulin thatis given to raise blood concentration of the insulin to an effectivelevel when needed (as opposed to continuous).

Presently, systems are available for continuously monitoring bloodglucose levels by inserting a glucose sensitive probe into the patient'ssubcutaneous layer or vascular compartment or, alternately, byperiodically drawing blood from a vascular access point to a sensor.Such probes measure various properties of blood or other tissuesincluding optical absorption, electrochemical potential, and enzymaticproducts. The output of such sensors can be communicated to a hand helddevice that is used to calculate an appropriate dosage of insulin to bedelivered into the blood stream in view of several factors such as apatient's present glucose level and rate of change, insulinadministration rate, carbohydrates consumed or to be consumed, steroidusage, renal and hepatic status and exercise. These calculations canthen be used to control a pump that delivers the insulin either at acontrolled basal rate or as a periodic or onetime bolus. When providedas an integrated system the continuous glucose monitor, controller, andpump work together to provide continuous glucose monitoring and insulinpump control.

Such systems at present require intervention by a patient or clinicianto calculate and control the amount of insulin to be delivered. However,there may be periods when the patient is not able to adjust insulindelivery. For example, when the patient is sleeping he or she cannotintervene in the delivery of insulin yet control of a patient's glucoselevel is still necessary. A system capable of integrating and automatingthe functions of glucose monitoring and controlled insulin deliverywould be useful in assisting patients in maintaining their glucoselevels, especially during periods of the day when they are unable tointervene.

Alternately, in the hospital environment an optimal glucose managementsystem involves frequent adjustments to insulin delivery rates inresponse to the variables previously mentioned. However, constantintervention on the part of the clinician is burdensome and most glucosemanagement systems are designed to maximize the time interval betweeninsulin updates. A system capable of safely automating low-riskdecisions for insulin delivery would be useful in improving patientinsulin therapy and supporting clinician workflow.

Since the year 2000 at least five continuous or semi-continuous glucosemonitors have received regulatory approval. In combination withcontinuous subcutaneous insulin infusion (CSII), these devices havepromoted research toward closed loop systems which deliver insulinaccording to real time needs as opposed to open loop systems which lackthe real time responsiveness to changing glucose levels. A closed loopsystem, also called the artificial pancreas, consists of threecomponents: a glucose monitoring device such as a continuous glucosemonitor (CGM) that measures subcutaneous glucose concentration (SC); atitrating algorithm to compute the amount of analyte such as insulinand/or glucagon to be delivered; and one or more analyte pumps todeliver computed analyte doses subcutaneously. Several prototype systemshave been developed, tested, and reported based on evaluation inclinical and simulated home settings. This concerted effort promisesaccelerated progress toward home testing of closed loop systems.

Similarly, closed loop systems have been proposed for the hospitalsetting and investigational devices have been developed and tested,primarily through animal studies. In addition, several manufacturers areeither in the process of developing or have submitted to the FDAautomated glucose measurement systems designed for inpatient testing.Such systems will accelerate the development of fully automated systemsfor inpatient glucose management.

The primary problem with closed loop control or full automation ofinsulin therapy is that a computerized system makes decisions that maybe high risk in terms of potential consequences if the patient'scondition changes or differs from the assumptions behind thecomputerized decision system. As a result of the automation these highrisk decisions are not uncovered until the risk is realized and thepatient displays an unacceptable medical condition. Second, in the eventof a device failure or medication management system or MMS failure,action is required by the automated system despite the potential lack ofinformation. Third, in scenarios in which frequent glucose measurementsare automatically collected but automation is not desired, it isundesirable to update the infusion at the same frequency as glucosemeasurements are collected. Fourth, when user intervention is requiredit may be undesirable or difficult for a clinician to respond at thebedside. For example, if the patient is in an isolation room but isobservable the clinician may desire to update the infusion rate withoutentering the room.

Thus, a principle object of the invention is to provide an improvedsystem for monitoring and delivering medication to a patient that makesrisk determinations before providing therapy.

Another object of the invention is to provide a system that minimizespatient risk by mapping device failure, patient state and condition, anduncertainty.

Yet another object of the invention is to provide a system formonitoring and delivering medication to a patient that minimizes therisk to a patient.

Another object of the invention is to provide a system for monitoringand delivering medication that is able to selectively request for a userintervention.

These and other objects, features, or advantages of the invention willbecome apparent from the specification and claims.

SUMMARY OF THE INVENTION

A system for monitoring and delivering medication to a patient and themethod of using the same. The system has a controller that has anadjustment or control algorithm and an automation risk monitor thatmonitors the control algorithm. More specifically, the present inventionis directed toward a system and method that monitors the risk to apatient of an automated therapy decision and allows a clinician tocustomize rules that determine whether an automated change in therapy isto be allowed or whether user/clinician intervention should be requiredbased upon the risk of automation and the customized rules. Thus, therisk of potential adverse consequences to the patient if the patient'scondition changes or differs from the assumptions behind thecomputerized or automated decision system can be minimized.

A sensor in communication with the controller monitors a medicalcondition to provide data to a rule based application in the controller.In addition, the rule based application receives data from the closedloop control and compares the data to predetermined medical informationto determine the risk to the patient. When the risk is below apredetermined risk threshold, medication or therapy adjustments areallowed to occur in an automated manner according to a closed loopalgorithm. Alternatively, when the risk is above the predetermined riskthreshold, the controller triggers a request for user intervention orreduces the degree of automated therapy allowed.

A system monitor in communication with the controller monitorsconditions and activity of the system and remote system. Upon detectionof a system failure the system monitor provides data to the controllerto determine whether to adjust treatment, message a clinician, and sendan alarm. Similarly, the system monitor tracks network activity todetect network failures or failures of remote systems such as aclinician messaging system. Depending on the conditions presented analarm system escalates the alarm sent.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a schematic diagram of a closed loop control system augmentedwith the automation risk monitor of the invention;

FIG. 2 is an example messaging diagram for the invention;

FIG. 3 is a schematic diagram showing the architecture of a semiautomatic glucose management system;

FIG. 4 is a schematic diagram of an automation risk monitor system; and

FIG. 5 is a schematic diagram of a closed loop control system augmentedwith the system monitor of the invention.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT

FIG. 1 provides a system 10 for monitoring and delivering medication,such as insulin, to a patient 12. The system 10 includes a controller 14that utilizes a control algorithm and an automation risk monitor 15 allpresented in a closed loop. A sensor 16 is in communication with thecontroller 14 and monitors a medical condition of the patient 12. A rulebased application 18 (see FIG. 4 for example) in the automation riskmonitor of the controller 14 receives data from the sensor 16 andcompares the data to predetermined medical information to determine therisk to the patient 12 to automate the delivery of medication.

The rule based application 18 can be set to assess the therapy beingadministered and its criticality. Further, the rule based application 18can assess currently administered drugs and 15 patient 12characteristics such as food intake, fluid intake, and disease state.Patient physiological response variables such as vitals, labs, andcognitive assessments can also be set to be used by the rule basedapplication 18 to determine the risk to the patient. The rule basedapplication 18 can also be set to include factors related to patientrisk parameters such as change in patient state and transitions intherapy such as beginning, continuing, changing, or ending therapy.

The rule based application 18 in one embodiment includes physician orclinician entered conditions of when automation is acceptable. Clinicianentered conditions can include therapy importance such as critical, lifesustaining, supplementary, and benign. Further, the clinician canestablish fail-safe, fail-operate, and fail-stop conditions for infusionthat are based on strict rules or based on ranges of conditions. Thesystem 10 is thus in communication with a clinician messaging system 20that communicates to a clinician when the risk of automation isunacceptable. In a preferred embodiment the messaging system is remotefrom the system 10.

The rule based application 18 in one embodiment can include a riskprofile wherein a clinician implements a risk profile according to ametric that may be qualitative (low, medium or 30 high) or quantitative(1-10 where 10 is the highest risk) and a threshold defining whenintervention is required. In either case, a quantitative metric isinternally calculated and compared to a quantitative threshold. Forexample, in the case of low, medium or high each qualitative measurementis assigned a quantitative value such as 2, 5 and 7 respectively.Consequently, a risk scale is specified and a threshold above whichintervention is requested. The rule based application 18 can alsoinclude a risk matrix that is developed to enable a determination ofrisk. Although the matrix is ultimately stored internally, it can beparameteritized by the user. One example of the risk matrix is shownbelow:

Glucose Range Glucose Δ Calculated Δ Risk (mg/dL) (derivative) toInsulin Level  0-70 Increasing Increasing High  0-70 IncreasingDecreasing Low  0-70 Decreasing Increasing High  0-70 DecreasingDecreasing Low 70-90 Increasing Increasing Medium 70-90 IncreasingDecreasing Low 70-90 Decreasing Increasing High 70-90 DecreasingDecreasing Low  90-120 Increasing Increasing Medium  90-120 IncreasingDecreasing Low  90-120 Decreasing Increasing High  90-120 DecreasingDecreasing Low 120-180 Increasing Increasing Low 120-180 IncreasingDecreasing Low 120-180 Decreasing Increasing Medium 120-180 DecreasingDecreasing Low 180-250 Increasing Increasing Low 180-250 IncreasingDecreasing High 180-250 Decreasing Increasing Medium 180-250 DecreasingDecreasing Low Above 250 Increasing Increasing High Above 250 IncreasingDecreasing Low Above 250 Decreasing Increasing Low Above 250 DecreasingDecreasing MediumSpecifically, the second column is the calculated or requested insulinlevel from the closed loop controller. The table is an example of howthe treatment condition is mapped to a risk level. There are numerousother methods for implementing this information which may includecontinuous mapping functions, fuzzy logic, probability calculations andthe like.

A second way to provide this type of system is to employ aninsulin/glucose pharmacokinetic/pharmacodynamic model as shown belowwhich predicts the future glucose level. The clinician can then use apredicted value rather than or in addition to glucose level and aderivative.

$\begin{matrix}{{{\overset{.}{G}(t)} = {{{- p_{G}} \cdot {G(t)}} - {{S_{I}(t)} \cdot G \cdot \frac{Q(t)}{1 + {\alpha_{G}{Q(t)}}}} + \frac{{P(t)} + {EGP} - {CNS}}{V_{G}}}}{{\overset{.}{I}(t)} = {{{- n}\frac{I(t)}{1 + {\alpha_{I}{I(t)}}}} + \frac{u_{ex}(t)}{V_{I}} + \frac{u_{en}(t)}{V_{I}}}}{{{\overset{.}{P}}_{1}(t)} = {{{- d_{1}}{P_{1}(t)}} + {P_{e}(t)}}}{{{\overset{.}{P}}_{2}(t)} = {{- {\min \left( {{d_{1}{P_{2}(t)}},P_{\max}} \right)}} + {d_{1}{P_{1}(t)}}}}{{P(t)} = {{\min \left( {{d_{2}{P_{2}(t)}},P_{\max}} \right)} + {P_{N}(t)}}}} & \; \\{{\overset{.}{G}(t)} = {{{- {p_{G}(t)}}{G(t)}} - {{S_{I}(t)}{G(t)}\frac{Q(t)}{1 + {\alpha_{G}{Q(t)}}}} + \frac{P(t)}{V_{G}}}} & (1) \\{{\overset{.}{Q}(t)} = {{- {{kQ}(t)}} + {{kI}(t)}}} & (2) \\{{\overset{.}{I}(t)} = {{{- n}\frac{I(t)}{1 + {\alpha_{I}{I(t)}}}} + \frac{u_{ex}(t)}{V_{I}}}} & (3)\end{matrix}$

In Equations (1)-(3), G(t) [mmol/L] denotes the total plasma glucoseconcentration, and I(t) [mU/L] is the plasma insulin concentration. Theeffect of previously infused insulin being utilized over time isrepresented by Q(t) [mU/L], with k [l/min] accounting for the effectivelife of insulin in the system. Exogenous insulin infusion rate isrepresented by u_(ex)(t) [mU/min], whereas P(t) [mmol/L min] is theexogenous glucose infusion rate. Patient's endogenous glucose removaland insulin sensitivity through time are described by p_(G)(t) [l/min]and S_(I)(t) [L/mU min], respectively. The parameters V_(I)[L] and V_(G)[L] stand for insulin and glucose distribution volumes. n [l/min] is thefirst order decay rate of insulin from plasma. Two Michaelis-Mentenconstants are used to describe saturation, with α_(I) [L/mU] used forthe saturation of plasma insulin disappearance, and α_(G) [L/mU] for thesaturation of insulin-dependent glucose clearance.

Thus, the rule based application 18 determines the risk to a patient 12by determining a predetermined risk threshold. Below the predeterminedrisk threshold, because low risk is detected, the system 10 can moveforward in an automated fashion and provide medication as required. Ifthe risk is determined to be above the predetermined risk threshold thecontroller triggers a request for user intervention by contacting theclinician messaging system 20 instead of moving forward with automation.

The system 10 can also be used to monitor any form of infusion includinganticoagulation monitoring during heparin infusion, respiratorymonitoring during pain medication infusion such as morphine, andhemodynamic monitoring during infusion of vasco-active medication forcardio vascular support.

As best understood in view of FIGS. 1-5, in an alternative embodimentthe system 10 includes a system monitor 22 that is in communication withthe controller 14. In one arrangement the system monitor 22 tracksnetwork activity on a network 30 to determine whether a network failurehas occurred. The system 22 also detects interruptions in communicationwith decision support provided by a remote system 23. Similarly, thesystem monitor 22 tracks network activity to determine whether aninterruption has occurred between the system 10 and the clinicianmessaging system 20 or other remote system 23 that allows for remoteoperation of the system 10 by a clinician or other basis of support suchas medical record tracking. In the event that an interruption isdetected the system 10 is enabled to continue infusion at either abackup infusion rate set by a clinician or the rule based application18. Alternatively, the system 10 can be configured to set an infusionrate based on a default setting that can include a minimum or maximumrate that depends on the physiological state of the patient 12 and thetherapy being administered.

In another embodiment the system monitor 22 detects air in line levels.In this embodiment the system monitor 22 determines whether the amountof air present in line is at a critical level that requires stopping theinfusion. When air in line is detected the system monitor 22 sends datato the controller 14 that uses the automation risk monitor 15 todetermine whether the criticality of treatment is sufficient to allowthe system 10 to continue to operate. In one arrangement, when air isdetected by the system monitor 22 an alarm is sent via the clinicianmessaging system 20 or emitted from the system 10 locally. The systemmonitor 22 also determines whether the detection of air in line is afalse positive and if a false positive is detected the alarm isauto-cleared. The system monitor 22 can also be set to not send an alarmif the amount of air present is non-critical.

Additionally, the system monitor 22 detects whether an occlusion ispresent. If an occlusion is detected the system monitor 22 sends data tothe controller 14 to determine whether the occlusion poses a sufficientrisk to adjust the infusion rate. Alternatively, if the controller 14determines a sufficient risk is presented by an occlusion an alarm canbe triggered or a message can be sent via the clinician messaging system20. In one arrangement the presence of occlusions is based on occlusionpressure levels.

In the event that the system monitor 22 detects a sufficient amount ofair or large enough occlusion the system 10 can activate a backup system24. For example, in a life-sustaining situation, a backup system 24would be enabled and the infusion rate set by the controller 14. In onearrangement, the backup system 24 maintains infusion parameters set bythe system 10 so that treatment can be transitioned withoutinterruption.

In another arrangement the system 10 includes a multi-channel infusionsystem 26 that allows for multiple treatment paths or channels 27. Whenthe system monitor 22 detects that one channel 27 has failed the system10 switches to an alternative channel 27 to deliver the infusion. In oneembodiment the system 10 adjusts the infusion rate of a concurrentlyinfused medication to compensate for the failure of a channel 27. Forexample, if a dextrose infusion fails in a hypoglycemic patient 12 thesystem 10 can increase the infusion of nutrition to compensate for thelack of dextrose being infused.

In one embodiment, the system monitor 22 tracks whether input isreceived from clinicians after the clinician is contacted via theclinician monitoring system 20 to input or confirm a therapy adjustment.If the clinician fails to respond the system monitor 22 sends data tothe controller 14 to adjust treatment based on information from theautomation risk monitor 15 as described previously.

An alarm system 28 can also be included in the system 10. The alarmsystem 28 determines the appropriate alarm to send depending on thelevel of patient risk, uncertainty, and predicted outcomes. In thismanner, the alarm system 28 provides the highest degree of alarm inassociation with critical events that require immediate attention.

In operation, the system 10 monitors a control algorithm of a controller14 to receive data. The controller 14 additionally receives continuousdata from a sensor 16 regarding a medical condition such as a glucoselevel. The controller 14 then compares the data from the controlalgorithm and the sensor 16 to predetermined medical information so thatthe controller 14 can determine a predetermined risk threshold ofautomating the delivery of medication. Then, based on the data, if arisk is below a predetermined threshold, automation is permitted and acommand or request for medication or insulin is provided to the insulinpump. Therefore the insulin delivery rate is automatically updatedaccording to the algorithm model or closed loop controller used.Alternatively, if the risk is at or above a predetermined threshold arequest for user intervention is triggered sending a message to theclinician messaging system 20 so that a user may intervene to make adetermination regarding whether the medication should be provided. Therequest for intervention is generated and sent directly to the userthrough a messaging system that is bi-directional. The message system 20provides information and requests a user response. When the response isrelated to a change in therapy an authentication step is included.

The response to a request is provided by the user directly through theuser interface of the system. Alternatively, the response can bereturned through an authenticated messaging system involving a uniqueidentifier specific to a positive or negative response. In the eventthat the clinician fails to respond the therapy may be continued at alower rate or stopped altogether. Optionally, an alarm can be generatedby the alarm system 28.

During the course of normal operation glucose measurements may bereceived that generate a change in the recommended insulin. However, thechange may not be significant enough to provide a therapeutic advantageto the patient versus the burden of requesting confirmation from thenurse. Consequently, a rule based application 18 is provided whichevaluates therapy changes to trigger a request for an automatic updateor nursing intervention. The input to the rule based application 18includes the blood glucose level, the change in glucose, the insulininfusion, the recommended change in insulin infusion, the estimatedinsulin on board, and the predicted glucose in the future. Rulesinvolving comparisons to thresholds, regression equations, andcalculations are created which trigger a therapy update based on theinputs.

In the event that an interruption to the normal operation of the system10, the remote systems 23, or network 30 is detected by the systemmonitor 22, the system adjusts therapy by altering the infusion rate ofthe system 10 or switching to a backup system 24. Additionally, if aninterruption is detected in a system 10 using multi-channel infusions26, the system 10 can alter the infusion rate or channel 27 used forinfusing to compensate for the channel 27 failure.

When a command request is made or an interruption to normal operation isdetected an alarm system 28 determines the appropriate alarm to send.The highest alarm is sent by the alarm system 28 based on the mostcritical failures of the system 10 or risks to the patient 12.

Thus, the present system can be used to make determinations of treatmentdecisions requiring user intervention based upon a diagnostic value, thechange in diagnostic value, the current drug infusion rate, the updateddrug infusion rate, the treatment target range, network failures, systemfailures, and clinician inactivity. In addition, the system notifies aclinician that intervention is required and receives the implementingclinician instruction in response to the notification.

An additional advantage is presented because the system 10 determineswhen clinician intervention is necessary and unnecessary. Specifically,system 10 is independent of an adaptive control algorithm or acomputerized protocol. The system 10 functions as a supervisor thatwatches the performance of the closed loop system. Consequently, datafrom the closed loop system and diagnostic sensor 16 are provided to therule based application 18 that uses a matrix to produce a quantitativelevel of risk. The level of risk can be expressed as a discrete generallevel such as the “High”, “Low” and “Medium” values expressed in thetable above or the level of risk can be a numerical value, score, indexor percentage. The risk is compared to a particular risk threshold toeither generate and/or provide an “okay” to proceed with therapy or totrigger a request for user intervention.

This operation differs from current systems that do not determine riskof automation. Instead prior art systems allow automation to occurregardless of potential risk and then when sensors indicate a patient isexperiencing an unacceptable medical condition a clinician is alerted.Therefore the system 10 provides an advantage of preventing theunacceptable medical condition from occurring in the first place as aresult of monitoring the automation process and predetermining risks ofautomation.

A further advantage is found in that the system 10 detects failures ofthe system 10, remote systems 23, networks 30, and inactivity ofclinicians. Upon detection of one of these failures or risks posed to apatient the alarm system 28 escalates alarms based on the risk or risksposed to the patient 12 based on changes to the patient 12 or the system10. Thus, at the very least all of the stated objectives have been met.

1.-17. (canceled)
 18. A system for controlling an automation of insulintherapy, the system comprising: a sensor connected with a controller,the sensor configured to detect measurements responsive to a glucoselevel in a patient; and one or more hardware processors configured to:determine a change in glucose level from the measurements; determine aninsulin volume for delivery to the patient based on the change inglucose level; apply a predetermined risk assessment matrix to thechange in glucose level and the determined insulin volume; estimate arisk in automatically delivering the insulin volume to the patient basedon the application of the predetermined risk assessment matrix; andcontrol pump for the delivery of the insulin volume to the patient basedon the estimated risk in automatically delivering the insulin volume.19. The system of claim 18, wherein the one or more hardware processesare further configured to detect failure in an infusion system and stopthe automated delivery of the insulin based on the detected failure. 20.The system of claim 19, wherein the failure comprises a network failure.21. The system of claim 19, wherein the failure comprises air in aninfusion line.
 22. The system of claim 19, wherein the failure comprisesocclusion of an infusion line.
 23. The system of claim 19, wherein theone or more hardware processors are configured to deliver insulin at apredetermined rate after the detected failure.
 24. The system of claim18, wherein the one or more hardware processors are configured to notifya clinician system when the estimated risk is high.
 25. The system ofclaim 18, wherein the estimation of risk is determined on a supervisorycomputing system that is independent from a closed loop control system.26. The system of claim 18, wherein the one or more hardware processorsare configured to pause the automated delivery when the estimated riskis high.
 27. A method for controlling an automation of insulin therapy,the method comprising: determining a change in glucose level frommeasurement received from a sensor; determining an insulin volume fordelivery to the patient based on the change in glucose level; applying apredetermined risk assessment matrix to the change in glucose level andthe determined insulin volume; estimating a risk in automaticallydelivering the insulin volume to the patient based on the application ofthe predetermined risk assessment matrix; and controlling pump for thedelivery of the insulin volume to the patient based on the estimatedrisk in automatically delivering the insulin volume.
 28. The method ofclaim 27, further comprising detecting failure in an infusion system andstop the automated delivery of the insulin based on the detectedfailure.
 29. The method of claim 28, wherein the failure comprises anetwork failure.
 30. The method of claim 28, wherein the failurecomprises air in an infusion line.
 31. The method of claim 28, whereinthe failure comprises occlusion of an infusion line.
 32. The method ofclaim 28, further comprising delivering insulin at a predetermined rateafter the detected failure.
 33. The method of claim 28, furthercomprising transmitting a notification message to a clinician systemwhen the estimated risk is high.
 34. The method of claim 28, wherein theestimation of risk is determined on a supervisory computing system thatis independent from a closed loop control system.
 35. The method ofclaim 28, further comprising pausing the automated delivery when theestimated risk is high.